CVE-2013-7379: API Admin Auth Weakness in tomato
Summary
CVE-2013-7379: API Admin Auth Weakness in tomato. Affects tomato versions < 0.0.6. Fixed in 0.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tomato is an npm package that provides an API admin service. It allows users to configure an access key for authentication purposes. The access key is intended to protect the API admin from unauthorized access.
Vulnerability Detail
Versions of tomato prior to 0.0.6 are affected by an authentication bypass vulnerability in the admin service. When only a single access key is configured on the server, an attacker can guess the password for the admin service in less than 200 requests. The vulnerability occurs because tomato verifies the access key by checking if the server access key incorporates the user-provided value at any location. This allows an attacker to provide a single character as an access key, and as long as the server key contains at least one instance of that character, it will be considered a valid key.
How To Fix
Minimum fixed version
0.0.6
This is the first release that contains the fix.
npm install tomato@0.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The tomato package prior to version 0.0.6 is vulnerable to an authentication bypass vulnerability in the admin service. It is recommended to update to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tomato →
FAQ
This vulnerability allows an attacker to bypass authentication and guess the password for the admin service in a relatively small number of requests.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update to the latest version of the tomato package.
No, only versions prior to 0.0.6 are affected by this vulnerability. It is recommended to update to version 0.0.6 or later.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-9vxc-g2jx-qj3p/GHSA-9vxc-g2jx-qj3p.json
Related vulnerabilities
Recent vulnerabilities recorded for tomato.
